{"id":"CVE-2026-117557","aliases":["DEBIAN-CVE-2026-117557","EUVD-2026-110835","GHSA-m3v7-j67w-q2pr","SUSE-SU-2026:5158-1","UBUNTU-CVE-2026-117557"],"status":"published","title":"SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00129,"percentile":0.02591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-10-27T13:07:52Z","modified":"2026-11-10T20:30:03Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"SDL2_image","fixed_in":["2.0.5-150300.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3+dfsg-1","2.6.3+dfsg-2","2.8.0+dfsg-1","2.8.1+dfsg-1","2.8.10+dfsg-1","2.8.12+dfsg-1","2.8.12+dfsg-2","2.8.2+dfsg-1","2.8.4+dfsg-1","2.8.5+dfsg-1","2.8.6+dfsg-1","2.8.6+dfsg-2","2.8.8+dfsg-1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.10+dfsg-1","2.8.12+dfsg-1","2.8.12+dfsg-2","2.8.8+dfsg-1","2.8.8+dfsg-1+deb13u1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.10+dfsg-1","2.8.12+dfsg-1","2.8.12+dfsg-2","2.8.8+dfsg-1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4+ds-1","3.2.4+ds-1+deb13u1","3.2.6+ds-1","3.3.4+ds-1","3.3.4+ds-2","3.4.0+ds-1","3.4.2+ds-1","3.4.4+ds-1","3.4.4+ds-2","3.4.6+ds-1","3.4.8+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4+ds-1","3.2.6+ds-1","3.3.4+ds-1","3.3.4+ds-2","3.4.0+ds-1","3.4.2+ds-1","3.4.4+ds-1","3.4.4+ds-2","3.4.6+ds-1","3.4.8+ds-1"]},{"source":"osv","ecosystem":"Debian:12","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-13","1.2.12-14"]},{"source":"osv","ecosystem":"Debian:13","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14"]},{"source":"osv","ecosystem":"Debian:14","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"SDL2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0+dfsg-2","2.0.0+dfsg-3","2.0.0+dfsg-3build2","2.0.0+dfsg-3+deb8u1build0.14.04.1","2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0+dfsg-3build2","2.0.1+dfsg-1","2.0.1+dfsg-2","2.0.1+dfsg-2+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+dfsg-3","2.0.1+dfsg-4","2.0.2+dfsg1-1","2.0.3+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5+dfsg1-1","2.0.5+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5+dfsg1-2","2.0.5+dfsg1-3","2.0.5+dfsg1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3+dfsg-2","2.8.0+dfsg-1","2.8.1+dfsg-1","2.8.2+dfsg-1","2.8.2+dfsg-1build1","2.8.2+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.8+dfsg-2","2.8.12+dfsg-1","2.8.12+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0+ds-1","3.4.4+ds-1","3.4.4+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.8+dfsg-1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4+ds-1","3.4.0+ds-1"]}],"products":[{"vendor":"libsdl-org","product":"sdl_image"}],"references":[{"url":"https://github.com/libsdl-org/SDL_image/issues/769","tags":["issue-tracking","report"]},{"url":"https://github.com/libsdl-org/SDL_image","tags":["product","package","report"]},{"url":"https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292","tags":["patch","fix","report"]},{"url":"https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996","tags":["patch","fix","report"]},{"url":"https://github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240","tags":["technical-description","article","report"]},{"url":"https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader","tags":["third-party-advisory","advisory","report"]},{"url":"https://hackmd.io/@haindpwn/sdl-image-lbm-ham-oob-read","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117557","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m3v7-j67w-q2pr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/117xxx/CVE-2026-117557.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-117557","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265158-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1289031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117557","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-117557","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-117557","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-117557","title":"SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T13:07:52.419Z","modified":"2026-11-04T16:52:35.775Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-04T17:34:39.974757Z"}],"euvd":[{"id":"EUVD-2026-110835","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T13:07:52Z","modified":"2026-11-04T16:52:35Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-04T18:12:44.477339Z"}],"ghsa":[{"id":"GHSA-m3v7-j67w-q2pr","title":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in...","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T15:32:44Z","modified":"2026-11-04T18:31:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-04T18:55:44.84967Z"}],"nvd":[{"id":"CVE-2026-117557","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T14:16:37.59Z","modified":"2026-11-04T17:17:31.53Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-04T20:08:22.802811Z"}],"osv":[{"id":"CVE-2026-117557","title":"SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T13:07:52.419Z","modified":"2026-11-10T20:42:19.689476859Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-10T21:13:26.339973Z"},{"id":"DEBIAN-CVE-2026-117557","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T14:16:37.59Z","modified":"2026-11-05T10:01:13.186900348Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"UBUNTU-CVE-2026-117557","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","status":"published","published":"2026-10-27T14:16:00Z","modified":"2026-10-28T20:17:46.297225539Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"SUSE-SU-2026:5158-1","title":"Security update for SDL2_image","description":"This update for SDL2_image fixes the following issue:\n\n- CVE-2026-117557: denial of service via crafted ILBM image file (bsc#1289031).\n","status":"published","published":"2026-11-10T09:33:12Z","modified":"2026-11-10T20:30:03.947598434Z","updated_at":"2026-11-10T20:43:04.310349Z"}]}}